> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/entra-id.md).
# Entra ID
Microsoft Entra ID (previously Azure AD) is a cloud-based identity and access management service that provides access to resources such as Microsoft 365, applications on the corporate intranet, the Azure portal, and thousands of other SaaS applications.
DoControl integrates with Microsoft Entra ID to extend the principle of least privilege beyond the identity layer. DoControl collects information about your Microsoft Entra ID group hierarchy and OAuth applications that have domain-wide delegation, and then registers to receive webhook events of user activity.
## Use cases
Integrate Microsoft Entra ID (previously Azure AD) with DoControl to address these use cases:
* **Role-based security controls** - Create and enforce security controls and sharing capabilities based on individuals, groups, or domains for risk-based protection of business-critical SaaS assets. This allows your organization to maintain business continuity with least privilege access.
* **Asset management** - Expose every internal and external user within your organization's SaaS estate, with the ability to slice and dice data (i.e. identify all assets exposed by a specific group or prevent sharing by an employee who belongs to a group).
* **Business-context extraction** - Extract the business-context of user events and activities within your environment. As a result, IT and security teams can better understand who has access and to what, as well as what activities pose a material risk when compared to standard business practice.
* **Data aggregation** - Aggregate and expose critical data about specific groups within Microsoft Entra ID for IT and security teams to make smarter decisions and reduce security risk.
* **Remediate past exposure** - Remediate in bulk to remove a specific Microsoft Entra ID app and prevent data overexposure.
* **Future-proofed workflows** - Implement secure workflows based on individuals, groups, or domains to mitigate the risk of data overexposure and exfiltration. For example, you can add a remediation action to workflows to remove an OAuth app from Microsoft Entra ID.
\
The Microsoft Entra ID-DoControl integration enables your organization to receive events coming from Microsoft Entra ID, such as audit events, which can include various types of data:
* User management
* Group management
* Application management
## Prerequisites
To integrate Microsoft Entra ID with DoControl, make sure you have fulfilled these prerequisites:
* Microsoft Entra ID is Business Basic Plan.
* You have [Microsoft 365](/docontrol-user-guide/integrations/microsoft-365.md) required permissions.
* Integrator must be one of the following:
* [ ] Global Administrator
* [ ] Privileged Role Administrator
* Before starting to integrate, you need to sign up with DoControl. Follow the onboarding steps in [Create first account](/docontrol-user-guide/getting-started/quick-start/set-up-docontrol-basics.md#create-first-account).
* You must activate the Microsoft 365 audit log. After turning on the audit log, it may take up to 12 hours for this action to take effect.
## Integrate Microsoft Entra ID with DoControl
1. From the DoControl side menu, click **Integrations**.
2. Under **Microsoft Entra ID**, click **Connect**. The Microsoft login window appears.
3. Enter your Microsoft admin credentials, then click **Allow**. \
You are returned to the DoControl **Integrations** page, and Microsoft Entra ID is now integrated.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/entra-id.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
